Networking

How workloads get an address, reach each other, and expose ports.

No daemon, no docker0. Volt attaches each workload to a Linux bridge and programs nftables directly — the same primitives your kernel and firewall already use.

The bridge

On first run Volt creates a bridge, voltbr0, with a private subnet (default 10.10.0.0/16). Every container or VM gets a veth/tap interface on that bridge and a private address; outbound traffic is NAT-masqueraded to the host's default route.

# Inspect the bridge and attached interfaces
ip -br addr show voltbr0
bridge link

Publishing a port

Nothing is reachable from outside the host until you publish it. Map a host port to a workload port with -p host:container:

# Expose the container's :80 on the host's :8080
volt run --name web -p 8080:80 nginx

# Bind to a specific host address / protocol
volt run --name api -p 127.0.0.1:9000:9000 -p udp:5353:53 my-api

Each mapping becomes an nftables DNAT rule in Volt's own table — it does not touch your other firewall rules.

Workload-to-workload

Workloads on voltbr0 share an L2 segment and can reach each other by private IP with no extra flags. Find an address with:

volt inspect web --format '{{.Network.IP}}'

Tip: Put related services on the same host and address them by their bridge IPs, or publish only the front door and keep back-ends unexposed.

DNS

Workloads resolve names using the host's resolver by default (the host /etc/resolv.conf is projected in). Override per workload:

volt run --dns 1.1.1.1 --dns 9.9.9.9 --name app my-image

Host networking

For workloads that must share the host's network namespace (no isolation, no NAT), use host networking. The workload binds host ports directly — use sparingly.

volt run --network host --name probe my-image

VM networking

MicroVMs attach to the same voltbr0 bridge through a tap device, so port mapping and workload-to-workload connectivity behave the same as containers. Inside the guest the interface comes up via DHCP or cloud-init.

The firewall

Volt manages a dedicated nftables table (it never edits iptables or your existing chains). Masquerade, DNAT for published ports, and default-deny inbound live there:

# See Volt's ruleset
nft list table inet volt

Troubleshooting

Symptom	Check
Workload has no address	`ip -br addr show voltbr0` — is the bridge up? `volt inspect <name>` for the veth.
`NO-CARRIER` on the guest interface	The tap/veth isn't enslaved to the bridge — restart the workload; confirm `bridge link` lists it.
Published port refused	`nft list table inet volt` for the DNAT rule; confirm the workload is listening on the container port.
No outbound connectivity	Masquerade rule present? Host IP forwarding on: `sysctl net.ipv4.ip_forward` should be `1`.
DNS fails inside a workload	Host `/etc/resolv.conf` valid, or pass --dns explicitly.

Next steps

Security Model — how isolation layers on top of the network.
CLI Reference — every volt run networking flag.
Virtual Machines — microVM specifics.